JP5081056B2 - Information leakage reduction between cache sharing processes - Google Patents

Description

  The present invention relates to the field of data processing systems. In particular, the present invention relates to the field of reducing information leakage during processing that shares one cache.

  There are many cases where the data values associated with one application running on a data processing device are sensitive data values that should not be accessible to other applications. In such situations, such sensitive data may be kept secure and loaded into the data processing device, for example, a hacking application that is loaded into the data processing device for the purpose of pursuing access to this sensitive data. Clearly it is important to make it inaccessible by other applications. This can be a particular problem when a cache is shared by multiple applications.

  It is known to provide a system in which a data processing device comprises a plurality of separate domains, and these domains provide a mechanism for handling security at the hardware level. Such a system is described, for example, in co-pending US Patent Application No. 10 / 714,561 of the same assignee, which describes a system having a secure domain and a non-secure domain. In that system, non-secure domains and secure domains actually establish separate worlds, and secure domains provide a reliable execution space separated from other execution spaces by hardware-enforced boundaries. And similarly, a non-secure domain provides an untrusted execution space.

  A software cryptographic system on a multi-processing system that uses a shared cache is generally not secure because both processes are shared by one process and information leakage may occur between the processes. It has been seen. The cache is somewhat transparent to the programmer in determining itself where to store the data. The known safety system as described above can prevent the non-secure process for storing data in the cache from accessing the data stored in the cache by the secure process. However, information about the data access pattern of one process may be derived by other processes, and this information may be sufficient to offset the security of the cryptographic system, for example.

FIG. 1 schematically illustrates cryptographic processing performed in the secure part of the system and untrusted part performed in the non-secure part of the system. Each time there is a conflict in processing time, a switch occurs between the processes. Untrusted processes cannot access data stored in the cache 60 by cryptographic processing. However, by saturating the cache 60, it can derive the cryptographic processing access pattern, and then access the cache 60 according to the execution of a portion of the cryptographic processing, which reads the data that has saturated the cache 60. Can do. Depending on the access time to this data, it is possible to know whether a part of the data has been overwritten, whether this untrusted or in this case the hacking process is an encryption process. A set of cache lines accessed by, can be identified by a hacking process. If the encryption process uses a data look-up table, it is capable enough to break the cipher. This is due to the “cache co-region timing attack on AES” by Bonneau and Mironov, http://www.stanford.edu/~jbonneau/AES_timing.ppt , and “cache attack and countermeasures by Osvik, Shamir and Tromer: AES In the case of “,” detailed at http://www.wisdom.weizmann.ac.il/tromer/.

  There are many possible solutions to this problem, some of which are described in these documents. For example, in a system having a secure domain for performing secure high reliability and a non-secure domain for performing untrusted processing, the cache can be erased at once when switching between these domains. it can. This is clearly uneconomical in performance and power.

  Instead, the cache can be split and a portion of the cache can be statically assigned to specific areas that affect performance. Alternatively, if a cache is not to be used, then no cache is used and instead a tightly coupled memory can be used as a lookup table. The disadvantage of this is that these memories are typically not large. If the tables are permanently stored in tightly coupled memory, this uses much of the limited memory space, but if they are copied when needed, performance and It becomes uneconomical in electricity.

  Another alternative is to calculate a look-up table during operation, which is slow and causes significant power costs.

  It would be desirable to prevent leakage of information regarding cache access operations in the sensitive processing section into untrusted processing without causing too much power or performance overhead.

A first aspect of the present invention provides a method for preventing information related to cache access operations in a section of confidential processing from leaking to untrusted processing, wherein the confidential processing and untrusted processing are data Performed by a processor in the processing device, the data processing device further comprising at least one cache operable to store information required by the processor while performing the confidential processing and the untrusted processing. The method comprises: prior to initiating processing of the confidential processing section by the processor, by means of the confidential processing loading information that may be requested by the section of the confidential processing in the at least one cache. if it will be driven away location of the at least one cache Comprising the step of expelling the stored information to the Deployment.

There are many advantages to allowing different processes to execute on one processor and share a cache. If some processes are confidential and others are untrusted, the mechanism is devised to prevent untrusted processes from accessing the data being manipulated. I came. However, even though it is known to protect data in this way, the fact that they share a single cache is that other information, such as sensitive cache access operations, can be trusted without care. It means that it can be withdrawn by not processing. The method of the present invention, when a section of the confidential process loads the cache information required, any information stored in the would will in the location of the cache to be driven away or otherwise by secret processing, confidential treatment A means to prevent this information leakage is provided by first expelling the processing of the section of the first. By expelling the information Upon start of the processing of sensitive section, this section of the confidential process has already been expelled all cache locations to load data, untrusted access operation of this section of the confidential process Processing cannot be pulled out. Thus, it is necessary to follow those sections where confidential processing has been processed and an untrusted process fills in each of these locations whether these locations were actually accessed by confidential processing, And by itself, no specific information can be retrieved for each cache location. Even if the cache line eviction procedure is interrupted, no sensitive data can be inferred from now on, even if the attacker gets information about how much eviction was completed when the interrupt occurred. This is not a security risk.

  A process is a sequence of instructions with its own memory addressing. A process may have several threads of operations.

In some embodiments, the method further includes: initiating processing of the section of the confidential processing by the processor; and in response to a switch request, during the processing of the section of the confidential processing. Switching the processor to an untrusted process; upon switching back from the untrusted process to the section of the confidential process, prior to resuming the process of the section of the confidential process, the at least one one of the required by the processing of the confidential processing in the cache are driven away or otherwise by the confidential process loading information, and a step of expelling the at least one location information stored in the cache.

Furthermore, any interrupt requesting a switch back from this section to untrusted processing by performing eviction at the start of processing in this section need not immediately perform these additional steps. These additional steps do not necessarily have to be performed if a switchback from untrusted processing occurs, but may delay these steps until switchback to a secure and secure process. The fact that it can make it possible to reduce untrusted switching latencies.

In some embodiments, the step of expelling the information stored in said at least one cache locations that may be driven away or otherwise by secret processing, the confidential processing of the at least one cache Storing the information that may be required by the section.

The important thing is to evict untrusted information stored in these locations, but the preferred way to do this is to evict and replace this information with information that may be required by a section of the confidential processor. That is. This clearly has a performance advantage in that the required information is pre-loaded into the cache so that the cache is available even if that section of the process actually requires it. Thus, even if this information is needed later by this section, the step of evicting the associated location can be performed with very little additional cost.

  In some embodiments, the processor is operable in a secure domain and a non-secure domain, and the program provides access to secure data that the processor cannot access while operating in the non-secure domain. The confidential process is a secure process executed in the secure domain, and the untrusted process is a non-trusted process. A process executed in the secure domain.

  Confidential and untrusted processes can be a number of different processes, for example they can be normal processes that run in a particular environment, in some embodiments they are further separated, The confidential processing is secure processing performed in the secure domain, and the untrusted processing is non-secure processing.

  In some embodiments, the processor is operable to process a plurality of untrusted processes within the non-secure domain and a plurality of sensitive processes within the secure domain, the method comprising at least Preventing leakage of information regarding cache access operations of a section of one of the sensitive processes to the plurality of untrusted processes.

  Secure and non-secure domains can be configured to be reliable for all processes running within the secure domain, and this method is relevant for sensitive and untrusted processes Information leakage between the plurality of secure processes is allowed.

In some embodiments, the step of switching between processing within the secure domain and non-secure domain is performed via a monitor mode, wherein the monitor mode is between multiple domains. When the switching is detected that includes a switching to the section of the confidential process, start the eviction of the said section by otherwise follow out to be the at least one information stored in the location of the cache confidential treatment To do.

Control for switching between the secure domain and the non-secure domain can be advantageously performed by the monitor mode. The monitor mode can act to prevent data leakage between domains and can be used to initiate information eviction .

  In some embodiments, the section of the confidential processing is a security critical section.

  The section of the confidential process in which the cache access operation is protected by this method is the entire confidential process, or a section in which security is particularly critical. This is the section where extremely sensitive data is processed. For example, it is a process that includes a cryptographic key.

  In some embodiments, the security critical section of the confidential processing includes cryptographic processing.

  Cryptographic processing involves computations where a cache access pattern is used to derive a cryptographic key. Thus, it is extremely important that in these cases these access patterns are not derived by untrusted processing.

  In some embodiments, the information stored in the at least one cache prior to processing of the security critical section is stored in at least one lookup table that the security critical section requests from data. It is.

  Embodiments of the present invention can be used for caches that store various types of information used in cryptography, for example, it can be used for instruction caches that store cryptographic instructions, It is applicable to cryptographic processing using a data lookup table. Such cryptographic processing is vulnerable to cache access pattern attacks, where cryptographic keys are derived from the analysis of cache access patterns. Thus, this technique is particularly useful when applied to caches that store these lookup tables.

In some embodiments, only one secure confidential process is processed by the data processing device, while in other embodiments, multiple confidential processes are processed by the data processing device, each with cryptographic processing. Sections, wherein the cryptographic processing sections request data from a plurality of lookup tables, and the data processing device further includes a plurality of lookup flags corresponding to each of the plurality of lookup tables, wherein The method further includes the steps of: setting the plurality of lookup flags to a first predetermined value prior to initiating processing in the secure mode; Before starting or resuming processing of one security critical section of processing I: wherein when a corresponding look-up flag is set to the first predetermined value, in said at least one cache, said plurality of said security critical section of the confidential process requests data from it Storing at least one of the look-up tables and setting the corresponding look-up flag to a second predetermined value; and the corresponding look-up flag is set to the second predetermined value And not storing the information in the at least one cache.

  If there are multiple cryptographic processes to be performed and request multiple lookup tables, it is advantageous to record which lookup tables are already stored in the cache, so that the cache Know if this data needs to be loaded into the cache to prevent access pattern leakage, or if this data needs to be loaded because it already exists in the cache be able to.

  In some embodiments, prior to executing the section of the confidential process, a predetermined step is performed to indicate that the section is to be executed, and further following completion of the section A step is performed to indicate that the section has been completed.

  When switching between processes, a step of recording this information is taken and available to the processing unit at the required time to inform the data processing unit whether a particular section of confidential processing is resumed. To be done. This helps the processor to efficiently control the steps that need to be taken to ensure reduced information leakage.

  In some embodiments, one of the predetermined steps includes setting an indicator value indicating that the section of the process is being performed, and one of the further steps is a step of the process. Resetting the indicator value to indicate that the section is no longer implemented; upon switching back to the sensitive process, determining whether the section is processed from the indicator value; , If so, start a handler routine that is requested by the section of the confidential process in the at least one cache prior to resuming the section of the confidential process. Storing the information that would be.

  A convenient way to record whether a particular section of sensitive processing is processed is to be handled by using indicator values, which are set and reset when the section is started or completed Can be done.

  In some embodiments, the information includes instructions, while in other embodiments, the information includes data.

  The details of the confidential processing cache access operations may lead to undesirable information leakage for both data cache and instruction cache accesses. Thus, embodiments of the present invention can be applied to both types of caches.

  In some embodiments, the location of the at least one cache includes a cache line.

  A further aspect of the invention includes a computer program product operable to control a data processor when executing on the data processor to perform the steps of the method according to the first aspect of the invention.

Still further aspects of the present invention are required by at least one processor adapted to perform confidential processing and untrusted processing, and in the processor during performing the confidential processing and untrusted processing. And at least one cache adapted to store information, the data processing device further comprising: control logic configured to detect the section of the confidential processing to be processed Including, prior to initiating or resuming processing of the section in response to detection of the section, the control logic is responsible for loading the confidential processing to be requested by the section of the confidential processing in the at least one cache. the information, otherwise follow out to the at least one calibration to be It is configured to expel the information stored in the shoe locations.

  These and other objects, features and advantages of the present invention will become apparent upon reading the following detailed description of exemplary embodiments in conjunction with the accompanying drawings.

  FIG. 2 schematically illustrates an untrusted process 10 performed within the non-secure domain and a confidential process 20 performed within the secure domain. The confidential process 20 has a security critical section 22 which is a cryptographic process including, for example, a lookup table. Prior to entering this section, the handler routine 24 is executed. This handler routine 24 analyzes what information is going to be needed by the critical section during processing, for example if it is cryptographic processing, what lookup table is then required And then preloads this information into the cache prior to initiating processing of this critical section. The figure then shows that section 22 is interrupted and untrusted process 10 is resumed. Because the handler routine preloads any information that may be needed by the security critical section 22, information regarding the access pattern of this part of the sensitive process can be retrieved by the untrusted process 10. It is not possible because the appropriate part of the cache is then actually saturated prior to executing on part 22. When the confidential processing 20 is resumed, the security critical section 22 is resumed. Prior to resuming processing of this section, the handler routine is executed once again. This once again ensures that information regarding critical sensitive portion cache access operations cannot be retrieved by the untrusted process 10. Furthermore, the latency of the interrupt IRQ is not affected by executing the handler routine when returning from, but not leaving, processing of the security critical section.

  FIG. 3 illustrates a data processing apparatus according to an embodiment of the present invention operable to process untrusted processing 10 and secure processing 20 as shown in FIG. The data processing apparatus includes a non-secure or untrusted domain 30 and a secure domain 40, and is controlled by a monitor mode 50 to switch between these domains. The non-secure domain 30 has an OS 32 that can control execution of the untrusted process 10 on the processor 12. When the untrusted process 10 (see FIG. 2) switches to the confidential process 20 (see FIG. 2), this switching is performed via the monitor mode 50.

  The secure domain 40 includes a secure kernel 70 having a security critical section indicator 72, which is set when the security critical section of code is processed, and Reset when completed. Thus, when it is set on switching from a non-secure domain to a secure domain, this indicates that the security critical section has not yet been completed and is therefore resumed.

  Secure kernel 70 also includes a handler routine 74, which is executed when starting or resuming a security critical section and is necessary to prevent leakage of information regarding cache access patterns. Act to perform various security steps. Secure domain 40 also includes a scoreboard 76 that is operable to store data related to the cryptographic look-up table. Each time a cryptographic lookup table is stored in the cache 60, the corresponding indicator bit in the scoreboard 76 is set so that a lookup table is requested by a security critical section. Even if the routine 74 determines, it can be seen from the scoreboard whether this data needs to be loaded. If it is not necessary to load data, it has been loaded with data that sets the corresponding indicator bit in the scoreboard 76 to record this. When switching back to a non-secure domain via monitor mode, the values in the scoreboard 76 are reset, instead they are reset prior to processing the security critical section of the secure process You can also In either case, it must be reset between processing in the non-secure domain and resumption of processing in the security critical section of the secure domain.

  When switching to the secure process 20 via the monitor 50 of the untrusted process 19, the monitor mode switches the process control to the secure kernel 70. The secure kernel 70 looks at the security critical section indicator 72 and checks whether the confidential processing 20 is currently in the security critical section 22 (see FIG. 2). If the security indicator 72 indicates that this is the case, the security kernel 70 operates and starts the handling routine 74 before this part of the program resumes. The handler routine 74 monitors from which lookup table the security critical section 22 of the process 20 requests data. These lookup tables are then preloaded into cache 60 and the corresponding lookup table indicator bits are set in score bit 76 to indicate that these lookups have been preloaded. At this point, the security critical section 22 can be processed by the cryptographic logic 80. Once the cryptographic logic 80 has processed this section, it returns control to the kernel 70 and the security critical section indicator bit 72 is reset. If there is an additional security critical section in process 20, bit 72 is set once more and the handler function is executed by control logic 74. This handler function looks at the next security critical section and monitors which lookup tables are needed. It then looks at the scoreboard 76 and monitors whether it is already preloaded in the cache 60. If this is the case, you don't need to preload it. If additional lookup tables are requested for those requested by the previous section, these are preloaded into cache 60 and the corresponding lookup table bits in scoreboard 76 are set. In that case, the cryptographic logic proceeds to process this portion of process 20. It should be noted that these various security critical sections can exist in a single thread of process 20 or in separate threads.

  If an interrupt occurs from the non-secure section of the processor to indicate that process 10 should be resumed, monitor mode 50 returns the process to process 10. At this point, the scoreboard bit is reset. This is done independently of returning the process to process 10, thereby not affecting the latency of the interrupt. Alternatively, they may be reset on return to secure processing.

  In this example, the scoreboard is used to track the loading of lookup tables in the cache related to which security critical sections have been entered, but this can be done in other ways. It will be apparent to those skilled in the art. For example, the secure kernel 70 can track which lookup table has been loaded into the logic in the secure kernel 70.

  FIG. 4 schematically shows one process performed by a data processing apparatus as described in FIG. As can be seen, process 10 switches to process 20, process 10 is an untrusted process, and process 20 is a confidential process. At the time of switching, if the indicator bit 72 indicates that the process 20 is in the security critical section 22, the handler routine 24 is called and executed. In response to the domain switch, handler routine 24 resets the values in scoreboard 76.

  The security critical section 22 is a thread T1 of the process 20 and requests the lookup table 1 and the lookup table 2. The handler routine 24 evaluates that the thread T1 needs Lookup Table 1 and Lookup Table 2, and sets these bits appropriately in the scoreboard 76 to retrieve this data from these tables. Load into cache. The security critical section 22 can then be processed. Following the interrupt IRQ, processing returns to processing 10. When processing switches back and section 22 is resumed, the handler routine 24 is executed once again in response to the indicator bit 72 being set. As shown in this example, the handler routine may itself be interrupted, and if this happens, the processor simply switches back to process 10, but the indicator bit is set and the handler is Indicates that it has been interrupted. When switching back to process 20, handler routine 24 must be started again before process 2 is resumed. This includes resetting the scoreboard and then restarting T1 by loading Lookup Table 1 and Lookup Table 2 and setting the appropriate bits in the scoreboard 76.

  This is one way to handle an interrupted handler routine, but if in other embodiments the handler cannot be aborted or restarted, or if it cannot be executed recursively, an interrupt will occur during execution of the handler routine. Is simply disabled. This is clearly a simple solution, but has the disadvantage of latency.

  When this thread T1 has been completed, thread T2 is then processed, which is also a confidential process and requires lookup table 1 and lookup table 3. Thus, the handler routine 24 is executed to load the lookup table 3, and the bit for the lookup table 3 is set in the scoreboard 76 because the lookup table is already in the cache. This is because the scoreboard 76 has indicated that it has been loaded, and thus the handler routine 24 knows that it is not necessary to load this table again. When thread T2 is complete, the next is a non-security critical section, thus the indicator bit 72 is reset.

  In the embodiments described above, it is assumed that information leakage between the secure domain and the non-secure domain is controlled and that all secure processes are reliable. This may not always be the case, and in some embodiments, switching threads in the secure domain also operates to cause the scoreboard 76 to disappear, thereby causing all lookups required for the next process. • It will be necessary to preload the table. Similarly, if two processes are in different security domains, but it is desirable that one cache access operation information cannot be observed by other processes, switching from process 1 to process 2 as in the previous example At that time, the handler routine is executed.

  FIG. 5 is a block diagram of a data processing system in which an embodiment of the present invention is employed. This system diagram includes two processor cores 110 and 120. Each of the processor cores 110 and 120 has its own associated level one cache 112 and 122. Various devices are connected via a system bus. Specifically, a system cache 130 is provided that can store data values for access by processor core 110 or processor core 120, and thus these processor cores share access to system core 130. To do.

  Also provided are one or more peripheral devices (not shown) that are accessed via a peripheral interface (not shown) to connect the system bus 90 to a peripheral bus (not shown). Are interconnected. These peripheral devices can exist off-chip or can be supplied on-chip.

  According to one embodiment of the present invention, the data processing apparatus has a plurality of domains, and the data processing apparatus can operate in these domains. In one particular embodiment, the plurality of domains includes a secure domain and a non-secure domain, and a predetermined access right is associated with each domain. Specifically, in one embodiment, while operating in a non-secure domain, a device can only access non-secure data associated with that non-secure domain. Therefore, any device operating in this non-secure domain cannot access secure data belonging to the secure domain. A given access right associated with a secure domain may take a variety of forms, but typically a device operating within a secure domain may have secure data in the secure domain and non-secure domain non- Allow access to both secure data.

  Each of the cores 110 and 120 can only operate in one domain at a time, but at any given time their individual processor cores can operate in separate domains relative to each other.

  Caches 112, 122, 130 in the data processing device can be arranged to store both secure and non-secure data, and one bit is associated with each cache line, The data stored in the cache line may be identified as secure data or non-secure data. Further details of caches arranged in such a manner are described in commonly assigned copending US Patent Application No. 10 / 714,481, the contents of which are incorporated herein by reference.

In accordance with an embodiment of the present invention, each of the cores 110, 120 is arranged to output a domain ID signal that identifies the domain in which its master device is currently operating. This can be used to allow or deny access to certain data in the cache, depending on the domain and security status of the cache. In this way, access to the secure data by the non-secure process operating on the core 1 110 or the core 2 120 can be denied. However, even if secure data can be protected from unauthorized access, cache access patterns can be compromised and information about secure data being processed by the secure domain may be leaked . When accessing an L1 cache specific to a particular core, the access pattern can be protected through the use of a handler routine as described above, where there are cache locations that may be accessed by the secure routine. , is driven away prior to the execution of the secure routine, or at least a secure routine is driven away before the execution of a specific critical section, thereby doing the secure data from the observation of the cache access patterns It is made impossible to pull it out.

However, the use of the system cache 130 by the security critical section of the code can be problematic because more than one processor accesses the cache at a time and it is difficult to protect the cache access pattern. It is. To address this problem, embodiments of the present invention can operate to ensure that only the local L1 cache is used in the security critical section of the code. Instead, it can be decided to use the system cache as long as it is assessed that there is an additional risk in doing so. Any use of a shared cache adds risk (perhaps acceptable), but it may spot other processing tasks that may drive out lines in the system cache and when they are reloaded at that time. Because it may.

  A further option for the handler routine is to enforce any security restrictions while executing certain “security critical sections”. In the case of a single processing core, these limits are only that the cache side channel must be closed. This is accomplished by ensuring that no sensitive data is available as a result of observing the cache access behavior of the secure process's sensitive section by some untrusted process. However, in the case of multi-core (as shown in FIG. 6), this may involve stopping all untrusted processing tasks in other cores until the security critical section is complete. I don't know. In such a case, it should be accepted to allow the use of system level cache by one security critical section.

  FIG. 6 shows an example of code used in one embodiment of the present invention. When a security critical section SCS is executed or resumed (after switching to a non-secure domain), the handler routine for that section is executed prior to the security critical section. Thus, when the SCS is executed in response to the EnterSCS instruction, the handler 1 is executed first. This includes preloading any lookup table required by the security critical section SCS into the data cache, thereby preventing the use of information about the access pattern of this data for the hacking process. To be done. This section is then left in response to the instruction LeavSCS.

  Then, non-secure processing is executed. At that time, in response to the enterSCS (handler 2), the handler for the next security critical section is executed prior to the execution of this section. This handler routine includes pre-loading of the instruction sequence required by the security section into the I-cache so that untrusted processes can retrieve information about the instruction access pattern of the security critical section. To prevent that. Alternatively, it may involve only invalidating a portion of the cache that may be accessed by the SCS being executed. It should be noted that during the processing of security critical section SCS2, if this process switches the domain to a non-secure domain, prior to resuming the security critical section SCS in the secure domain. The handler routine (handler 2) needs to be executed again.

  Although exemplary embodiments of the present invention have been described in detail herein with reference to the accompanying drawings, it should be understood that the invention is not limited to those precise embodiments, and is not limited to the appended claims. It will be understood by those skilled in the art that various changes and modifications can be made therein without departing from the scope and spirit of the invention as defined in this section.

Figure 3 schematically illustrates untrusted and secure processing sharing one cache according to the prior art. Fig. 4 schematically shows a non-secure process and a secure process executed by an embodiment of the present invention. 1 schematically illustrates a data processing apparatus according to an embodiment of the present invention. Fig. 4 schematically shows a non-secure process and a secure process with different threads according to an embodiment of the present invention. 1 is a block diagram of a data processing system that can be employed in embodiments of the present invention. FIG. An exemplary cryptographic code is shown.

Explanation of symbols

10 Untrusted processing 20 Confidential processing 22 Security critical section 24 Handler routine 30 Non-secure domain 32 OS of untrusted processing
40 Secure Domain 50 Monitor Mode 60 Cache 70 Secure Kernel 72 Security Critical Section Indicator 74 Handler Routine 76 Scoreboard 90 System Bus 110 Processor Core 112 Level One Cache 120 Processor Core 122 Level One cache 130 System cache T1 thread T2 thread

Claims (19)

A method of preventing cache access operation information of a confidential processing section from leaking to an untrusted process, wherein the confidential process and the untrusted process are performed by a processor in a data processing device, and the data processing apparatus further comprises said confidential processing and trusted to have no treatment of at least one operable to store the information required by the processor during the performance cache, the method comprising:
The confidential processing by the processor so that information stored in the location of the at least one cache is not evicted by confidential processing loading information that may be required by the section of the confidential processing in the at least one cache. Prior to initiating processing of one section of the at least one cache, the information stored in the location of the at least one cache and the information that may be requested by the section of the confidential processing in the at least one cache Said method comprising the step of storing . The method further
Initiating processing of the section of the confidential processing by the processor ;
Switching the processor to the untrusted process during processing of the section of the confidential process in response to a switch request ;
Upon switching back from the untrusted process to the section of the confidential process, the at least one of the confidential process loading information that may be required by the section of the confidential process in the at least one cache. Evicting information stored in the at least one cache location prior to resuming processing of the section of the sensitive process so that information stored in the cache location is not evicted. The method of claim 1 comprising:   The processor is operable with the processor in a secure domain and a non-secure domain, the processor being inaccessible while executing a program in the secure domain and the processor operating in a non-secure domain The program is operable to access secure data, the confidential process is a secure process executed in the secure domain, and the untrusted process is executed in a non-secure domain The method according to claim 1, which is a process to be performed. The processor is operable to process a plurality of untrusted processes in a non-secure domain and a plurality of sensitive processes in a secure domain, the method comprising: 4. The method of claim 3 , wherein information regarding cache access operations of a section is prevented from leaking to the plurality of untrusted processes. The method of claim 3 , wherein the step of switching between the secure domain and the non-secure domain is performed via a monitor mode. When switching between the domains detects that includes a switching to the section of the confidential process according to claim wherein said at least one cache flush the information stored in the location, the monitor mode is started 5 The method described. 4. The method of claim 3 , wherein the section of the sensitive process is a security critical section. The method of claim 7 , wherein the security critical section of the confidential processing includes cryptographic processing. Prior to the processing of the security critical section, the information stored in the at least one cache, said security critical section is at least one of claim 8, wherein the look-up table for requesting data Method. A plurality of confidential processes are processed by the data processing device, each including a cryptographic processing section, wherein the cryptographic processing section requests data from a plurality of lookup tables, and the data processing device further includes the plurality of lookup tables. A plurality of lookup flags corresponding to each of the
Prior to initiating processing in the secure mode, the plurality of lookup flags are set to a first predetermined value ,
Prior to resume processing of one security critical section of the plurality of secure processing by the processor, when the front SL corresponding lookup flag is set to the first predetermined value, said at least one In one cache, the security critical section of the sensitive process stores at least one of the plurality of lookup tables requesting data, and the corresponding lookup flag is set to a second predetermined value. if prior SL corresponding lookup flag is set to the second predetermined value, the do not store the information to at least one cache, the method according to claim 9.   Prior to executing the section of the confidential processing, a predetermined step is performed to indicate that the section is to be performed, and then completion of a further step of the section is performed to complete the section. The method of claim 1, wherein an indication is made. One of the predetermined steps includes setting an indicator value to indicate that the section of the process is being processed, and one of the further steps is to reset the indicator value and 12. The method of claim 11 , comprising indicating that the section is no longer processed .
When switching back to the sensitive process, it determines if the section should be processed from the indicator value and if so starts a handler routine, 12. The method of claim 11 , comprising storing information that would be required by the section of the confidential process in the at least one cache prior to resuming the section of the confidential process.   The method of claim 1, wherein the information includes instructions.   The method of claim 1, wherein the information includes data.   The method of claim 1, wherein the location of the at least one cache includes a cache line. A computer program storage medium operable to control the data processor when executed on the data processor to perform the steps of claim 1. At least one processor adapted to perform confidential processing and untrusted processing; and at least one processor adapted to store information required of the processor during the confidential processing and untrusted processing. A data processing device including a cache, the data processing device further comprising control logic configured to detect a section of the confidential processing to be processed, the confidential processing in the at least one cache Initiating processing of the section in response to detection of the section, such that information stored in the at least one cache location is not evicted by the sensitive processing loading information that may be required by the section of Prior to resuming, said at least one It said data processing apparatus, wherein the control logic for storing the information that may be requested by the section of the confidential processing of the at least one cache and basil driven away the information stored in the cache location is configured. The data processing apparatus further includes an indicator value store, wherein the control logic stores a predetermined value in the indicator value store and completes the processing of the section in response to the start of processing of the section. 18. The data storage device of claim 17 , wherein the data storage device is configured to store different values in the indicator value store in response to. The data processing device further includes a scoreboard configured to store a plurality of lookup flags, the plurality of lookups prior to the control logic initiating processing in the secure mode. Prior to starting or resuming processing of one security critical section of the plurality of secure processes by setting a flag to a first predetermined value ;
The plurality of lookup tables for which the security critical section of the sensitive process requests data in the at least one cache when the corresponding lookup flag is set to the first predetermined value. Storing in at least one and setting the corresponding lookup flag to a second predetermined value;
18. The data processing apparatus of claim 17 , wherein the information is not stored in the at least one cache if the corresponding lookup flag is set to a second predetermined value.

Images